CVE-2026-45023 affects Significant-Gravitas AutoGPT, a platform for managing AI agents. The vulnerability arises from a missing credit consumption check in the external API endpoint POST /api/blocks/{block_id}/execute. While the internal graph execution path enforces credit checks, direct calls to this endpoint bypass those checks, allowing users to execute blocks without decrementing their credit balance. This constitutes an allocation of resources without limits or throttling (CWE-770). The vulnerability is resolved in AutoGPT version 0.6.59.

Users can exploit this vulnerability to execute an unlimited number of blocks without consuming credits, potentially leading to resource exhaustion or denial of service. The integrity of credit-based usage controls is compromised, allowing unauthorized free usage of the platform's resources. There is no direct confidentiality impact reported. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Upgrade AutoGPT to version 0.6.59 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Users should ensure that all API calls are routed through the graph execution path that enforces credit checks. Patch status is confirmed fixed in 0.6.59.